How to use the Linux 'lsof' command to list open files

Linux “open files” FAQ: Can you share some examples of how to show open files on a Linux system (i.e., how to use the lsof command)?

lsof command background

The Linux lsof command lists information about files that are open by processes running on the system. The lsof command itself stands for “list of open files.” In this article I’ll share some lsof command examples.

Also Read: 102-500: Linux Administrator - 102 (LPIC-1 102)

I assume you’re logged in as root

One other note: In these examples I'll assume that you're logged in as the Unix/Linux root user. If not, you’re lsof command output may be significantly limited. If you’re logged in as a non-root user, either su to root, or use sudo to run these commands.

Basic Linux lsof command examples

Typing the lsof command by itself lists all open files belonging to all active processes on the system:

$ lsof

On my current Mac OS X system, which has been running for a long time, this shows a lot of open files, 1,582 to be specific:

$ lsof | wc -l
    1582

Note that I didn’t have to be logged in as the root user to see this information on my Mac system.

Adding the head command to lsof shows what some of this output looks like:

$ lsof | head

COMMAND     PID USER   FD     TYPE     DEVICE  SIZE/OFF      NODE NAME
loginwind    32   Al  cwd      DIR       14,2      1564         2 /
loginwind    32   Al  txt      REG       14,2   1754096 243026930 /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow
loginwind    32   Al  txt      REG       14,2    113744   3190067 /System/Library/LoginPlugins/FSDisconnect.loginPlugin/Contents/MacOS/FSDisconnect
loginwind    32   Al  txt      REG       14,2    425504 117920371 /System/Library/LoginPlugins/DisplayServices.loginPlugin/Contents/MacOS/DisplayServices
loginwind    32   Al  txt      REG       14,2      3144   3161654 /System/Library/ColorSync/Profiles/sRGB Profile.icc
loginwind    32   Al  txt      REG       14,2     96704 242998403 /System/Library/PrivateFrameworks/MachineSettings.framework/Versions/A/MachineSettings
loginwind    32   Al  txt      REG       14,2     51288 251253153 /private/var/folders/h5/h59HESVvEmG+3I4Q8lOAxE+++TI/-Caches-/mds/mdsDirectory.db
loginwind    32   Al  txt      REG       14,2    724688 117923285 /System/Library/LoginPlugins/BezelServices.loginPlugin/Contents/MacOS/BezelServices
loginwind    32   Al  txt      REG       14,2    329376 117923166 /System/Library/Extensions/IOHIDFamily.kext/Contents/PlugIns/IOHIDLib.plugin/Contents/MacOS/IOHIDLib

Common lsof options

As mentioned, these details go on for 1,582 lines, so it helps to have some way to weed through that output, whether that involves using the grep command, or some of the lsof options shown below.

This command lists all open files belonging to PID (process ID) 11925:

$ lsof -p 11925

This command lists all open files belonging to processes owned by the user named "al":

$ lsof -u al

This command lists files that are open in the directory specified, but it does not descend into sub-directories:

$ lsof +d '/Users/al'

The next command lists files that are open in the directory specified, and also descends into sub-directories. Beware: this can take a very long time to run for large directory structures:

$ lsof +D '/Users/al'